| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GenVariant.Jaik.462, Zugriff durch rundll32.exeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
05.02.2014, 13:04
| #1 |
| |  GenVariant.Jaik.462, Zugriff durch rundll32.exe Hallo liebes Trojaner-Board, auf dem PC meines Vaters hat Bitdefender heute einen Virus blockiert und desinfiziert (ein paar Minuten nach dem booten, beim checken von Mails in Thunderbird, allerdings wurden nur zwei Anhänge mit pdfs von vertrauenswürdigen Quellen geöffnet, die auch geprüft habe). Virusname GenVariant.Jaik.462 Zugriff durch rundll32.exe Adresse C:\Program Files(x86)\Zarb 4\Zarb.exe Zarb ist ein Programm für Word mit dem man Arbeitsblätter erstellen kann. Ein Tiefenscan hat anschließend nichts gefunden, ich traue dem Braten aber nicht ganz. Daher würde ich gerne wissen, was ich noch prüfen soll, damit ich (relativ) sicher sein kann, dass der PC sauber ist. bitfedender log: Code:
ATTFilter BitDefender Protokolldatei
Produkt BitDefender Internet Security 2011
Prüfaufgabe: Tiefensystem-Scan
Berichtsdatum: Dienstag, 4. Februar 2014 21:22:13
Berichtspfad: C:\ProgramData\BitDefender\Desktop\Profiles\Logs\dcf483c4-26d0-4e6f-ba28-6a53a00adae1\1391541061_1_01.xml
Prüfpfad:
Pfad : C:\
Pfad : D:\
Pfad : I:\
Pfad : M:\
[-]Zusammenfassung Scan-Ergebnisse
[-]Nicht geprüfte Objekte:
Objektpfad Grund: Abschluss Status
Datei: I:\WD SmartWare.swstor\***\Volume.56c3adec.a6c6.11df.8ba6.806e6f6e6963\Eigene Dokumente\Telekom\2007_04einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: D:\Eigene Dokumente\Telekom\2007_05einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: I:\WD SmartWare.swstor\***\Volume.56c3adec.a6c6.11df.8ba6.806e6f6e6963\Eigene Dokumente\Telekom\2007_05einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: D:\Eigene Dokumente\Telekom\2007_06einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: I:\WD SmartWare.swstor\***\Volume.56c3adec.a6c6.11df.8ba6.806e6f6e6963\Eigene Dokumente\Telekom\2007_06einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: D:\Eigene Dokumente\Telekom\2007_07einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: I:\WD SmartWare.swstor\***\Volume.56c3adec.a6c6.11df.8ba6.806e6f6e6963\Eigene Dokumente\Telekom\2007_07einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: D:\Eigene Dokumente\Telekom\2007_08einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: I:\WD SmartWare.swstor\***\Volume.56c3adec.a6c6.11df.8ba6.806e6f6e6963\Eigene Dokumente\Telekom\2007_08einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: D:\Eigene Dokumente\Telekom\2007_10einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: D:\Eigene Dokumente\Telekom\2007_09einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: D:\Eigene Dokumente\Telekom\2006_11einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: I:\WD SmartWare.swstor\***\Volume.56c3adec.a6c6.11df.8ba6.806e6f6e6963\Eigene Dokumente\Telekom\2007_10einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: I:\WD SmartWare.swstor\***\Volume.56c3adec.a6c6.11df.8ba6.806e6f6e6963\Eigene Dokumente\Telekom\2007_09einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: I:\WD SmartWare.swstor\***\Volume.56c3adec.a6c6.11df.8ba6.806e6f6e6963\Eigene Dokumente\Telekom\2006_11einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: D:\Eigene Dokumente\Telekom\2007_02einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: D:\Eigene Dokumente\Telekom\2006_12einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: I:\WD SmartWare.swstor\***\Volume.56c3adec.a6c6.11df.8ba6.806e6f6e6963\Eigene Dokumente\Telekom\2007_02einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: I:\WD SmartWare.swstor\***\Volume.56c3adec.a6c6.11df.8ba6.806e6f6e6963\Eigene Dokumente\Telekom\2006_12einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
Datei: D:\Eigene Dokumente\Telekom\2007_04einzelverbindungen_***_schluessel.pdf Passwortgeschützt Nicht geprüft (Datei war passwortgeschützt)
[-]Ausführliche Scan-Zusammenfassung
[-]Standard
Geprüfte Objekte: 688143
Infizierte Objekte: 0 (es wurden keine infizierten Objekte gefunden)
Verdächtige Objekte: 0 (es wurden keine verdächtigen Objekte gefunden)
Geklärte Objekte: 0 (keine Bedrohungen während des Prüfvorgangs gefunden)
Ungeklärte Objekte: 0 (keine ungelösten Probleme)
[-]Erweitert
Vergangene Zeit: 01: 11: 11
Dateien pro Sekunde: 161
Übersprungene Objekte: 218135
Passwortgeschützte Objekte: 20
Überkomprimierte Objekte: 0
Geprüfte Archive: 2243
Input-Output Fehler: 58
Geprüfte Boot-Sektoren: 8
Geprüfte Prozesse: 4860
Infizierte Prozesse: 0
Geprüfte Registry Schlüssel: 4722
Infizierte Registry Schlüssel: 0
Geprüfte Cookies: 75
Infizierte Cookies: 0
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014
Ran by *** (administrator) on *** on 04-02-2014 22:18:04
Running from C:\Users\***\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\pchooklaunch64.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\Antispam32\pchooklaunch32.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
() C:\Windows\SysWOW64\XSrvSetup.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(CANON INC.) C:\Program Files (x86)\Canon\MyPrinter\BJMYPRT.EXE
(Elgato Systems) C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
() C:\Program Files (x86)\dradio-Recorder\phonostarTimer.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(FileHippo.com) C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(BitDefender S.R.L.) C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe
(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe
(Western Digital) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Logitech, Inc.) C:\Program Files (x86)\Logitech\SetPoint\SetPoint.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpWareSE4.exe
(Dropbox, Inc.) C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Western Digital) C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\Logitech\SetPoint\x86\SetPoint32.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NANotify.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9642528 2009-12-08] (Realtek Semiconductor)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files (x86)\Canon\MyPrinter\BJMyPrt.exe [2710856 2009-11-02] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] - C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-04] (CANON INC.)
HKLM\...\Run: [BitDefender Antiphishing Helper] - C:\Program Files\BitDefender\BitDefender 2011\ieshow.exe [109344 2011-06-02] (BitDefender S.R.L.)
HKLM\...\Run: [BDAgent] - C:\Program Files\BitDefender\BitDefender 2011\bdagent.exe [2026680 2011-07-11] (BitDefender S.R.L.)
HKLM-x32\...\Run: [JMB36X IDE Setup] - C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [SSBkgdUpdate] - C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [OpwareSE4] - C:\Program Files (x86)\ScanSoft\OmniPageSE4\OpwareSE4.exe [79400 2007-02-04] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [BitDefender Antiphishing Helper] - C:\Program Files\BitDefender\BitDefender 2011\Antispam32\ieshow.exe [92352 2011-06-02] (BitDefender S.R.L.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642808 2012-12-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [WD Drive Unlocker] - C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe [1688008 2012-06-13] (Western Digital)
HKLM-x32\...\Run: [WD Quick View] - C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5237256 2012-12-20] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKU\S-1-5-21-512264234-1616448173-2520258103-1000\...\Run: [Remote Control Editor] - C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe [1689088 2010-06-09] (Elgato Systems)
HKU\S-1-5-21-512264234-1616448173-2520258103-1000\...\Run: [dradio-RecorderTimer] - C:\Program Files (x86)\dradio-Recorder\phonostarTimer.exe [41472 2012-04-03] ()
HKU\S-1-5-21-512264234-1616448173-2520258103-1000\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [385024 2010-05-04] (AMD)
HKU\S-1-5-21-512264234-1616448173-2520258103-1000\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKU\S-1-5-21-512264234-1616448173-2520258103-1000\...\MountPoints2: {162a9588-c8b7-11df-97db-6cf049e199b3} - G:\setup.EXE /AUTORUN
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x44C531B77941CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: No Name - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - Bitdefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2011\IEToolbar.dll (BitDefender S.R.L.)
Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
Toolbar: HKLM-x32 - Bitdefender Toolbar - {381FFDE8-2394-4F90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2011\Antispam32\IEToolbar.dll (BitDefender S.R.L.)
Toolbar: HKLM-x32 - No Name - {9C65D12D-CF9D-454D-8049-61965D8C6FFF} - No File
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\jv1exzom.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=1.1.11 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @phonostar.de/phonostar - C:\Program Files (x86)\dradio-Recorder\npphonostarDetectNP.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: TVU Web Player - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\jv1exzom.default\Extensions\firefox@tvunetworks.com [2010-08-14]
FF Extension: TCAST Plugin - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\jv1exzom.default\Extensions\tcastv1@tom.com [2010-08-14]
FF Extension: WOT - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\jv1exzom.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26]
FF Extension: DownloadHelper - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\jv1exzom.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-08-27]
FF Extension: Flash and Video Download - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\jv1exzom.default\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2014-01-23]
FF Extension: Ghostery - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\jv1exzom.default\Extensions\firefox@ghostery.com.xpi [2013-08-18]
FF Extension: 1-Click YouTube Video Downloader - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\jv1exzom.default\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2014-01-19]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\jv1exzom.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-20]
FF Extension: Adblock Plus - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\jv1exzom.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-09-30]
FF HKLM\...\Firefox\Extensions: [FFToolbar@bitdefender.com] - C:\Program Files\BitDefender\BitDefender 2011\bdaphffext\
FF Extension: BitDefender Antiphishing Toolbar - C:\Program Files\BitDefender\BitDefender 2011\bdaphffext\ []
FF HKLM\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\
FF Extension: bdToolbar - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\ []
FF HKLM-x32\...\Firefox\Extensions: [FFToolbar@bitdefender.com] - C:\Program Files\BitDefender\BitDefender 2011\bdaphffext\
FF Extension: BitDefender Antiphishing Toolbar - C:\Program Files\BitDefender\BitDefender 2011\bdaphffext\ []
FF HKLM-x32\...\Firefox\Extensions: [{09F060FA-566D-42D7-BF79-97AB30863433}] - C:\Program Files (x86)\Steganos Privacy Suite 12\pfplugin
FF HKLM-x32\...\Firefox\Extensions: [{00F0643E-B367-4779-B45D-7046EBA37A88}] - C:\Program Files (x86)\Steganos Privacy Suite 12\spmplugin3
FF HKLM-x32\...\Thunderbird\Extensions: [bdThunderbird@bitdefender.com] - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\
FF Extension: bdToolbar - C:\Program Files\BitDefender\BitDefender 2011\bdtbext\ []
Chrome:
=======
CHR HomePage: about:blank
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Foxit Reader Plugin for Mozilla) - C:\Program Files (x86)\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll No File
CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Nitro PDF Plug-In) - C:\Program Files\Nitro PDF Reader\npnitromozilla.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Windows Activation Technologies) - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
CHR Extension: (Google Docs) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-28]
CHR Extension: (Google Drive) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-28]
CHR Extension: (WOT) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2013-04-28]
CHR Extension: (YouTube) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-28]
CHR Extension: (Google-Suche) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-28]
CHR Extension: (AdBlock) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-04-28]
CHR Extension: (Ghostery) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2013-04-28]
CHR Extension: (Google Wallet) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-28]
CHR Extension: (Google Mail) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-28]
==================== Services (Whitelisted) =================
R2 JMB36X; C:\Windows\SysWOW64\XSrvSetup.exe [65536 2009-08-06] ()
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-03-26] (Nitro PDF Software)
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [271920 2007-03-12] (Nero AG)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3673944 2011-11-18] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [271760 2009-04-15] ()
S3 Update Server; C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [467248 2010-11-30] (BitDefender)
R2 Updatesrv; C:\Program Files\BitDefender\BitDefender 2011\updatesrv.exe [53224 2011-06-02] (BitDefender S.R.L.)
R2 VSSERV; C:\Program Files\BitDefender\BitDefender 2011\vsserv.exe [2660624 2011-07-11] (BitDefender S.R.L.)
S2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1155088 2012-12-20] (Western Digital )
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [248248 2012-09-06] (Western Digital)
S2 WDRulesService; C:\Program Files (x86)\Western Digital\WD SmartWare\WDRulesEngine.exe [1178128 2012-12-20] (Western Digital )
S2 Secunia Update Agent; "C:\Program Files (x86)\Secunia\PSI\sua.exe" --start-service [X]
==================== Drivers (Whitelisted) ====================
R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138872 2011-07-28] (SlySoft, Inc.)
R3 AnyDVD; C:\Windows\SysWOW64\Drivers\AnyDVD.sys [138872 2011-07-28] (SlySoft, Inc.)
S3 avc3; C:\Windows\System32\DRIVERS\avc3.sys [591968 2010-11-29] (BitDefender)
S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [1186272 2010-11-29] (BitDefender)
R3 BDFM; C:\Windows\System32\DRIVERS\bdfm.sys [162896 2010-05-13] (BitDefender S.R.L. Bucharest, ROMANIA)
R1 Bdfndisf; c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [88144 2010-08-20] (BitDefender)
R0 bdfsfltr; C:\Windows\System32\DRIVERS\bdfsfltr.sys [431176 2011-04-01] (BitDefender)
R1 bdfwfpf; C:\Program Files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys [99408 2010-08-20] (BitDefender)
R3 MTSBDA; C:\Windows\System32\DRIVERS\MtsBda.sys [348224 2009-11-09] (TerraTec Provide)
R3 MtsHID; C:\Windows\System32\DRIVERS\MtsHid.sys [25664 2009-11-09] (TerraTec Provide)
R1 SLEE_17_DRIVER; C:\Windows\Sleen1764.sys [108256 2011-09-12] (Softwareentwicklung Remus - ArchiCrypt - )
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [560184 2012-10-19] (Duplex Secure Ltd.)
R1 STGMFEngine64; C:\Windows\system32\drivers\STGMFEngine64.sys [28576 2011-09-12] (Softwareentwicklung Remus - ArchiCrypt.com)
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-04 22:18 - 2014-02-04 22:18 - 00021880 _____ () C:\Users\***\Downloads\FRST.txt
2014-02-04 22:17 - 2014-02-04 22:18 - 00000000 ____D () C:\FRST
2014-02-04 22:16 - 2014-02-04 22:16 - 00380416 _____ () C:\Users\***\Downloads\gqsfq858.exe
2014-02-04 22:15 - 2014-02-04 22:16 - 02080256 _____ (Farbar) C:\Users\***\Downloads\FRST64.exe
2014-02-04 22:15 - 2014-02-04 22:15 - 00000000 _____ () C:\Users\***\AppData\Roaming\.NANotifyHere
2014-02-04 22:08 - 2014-02-04 22:08 - 00000584 _____ () C:\Users\***\Downloads\defogger_disable.log
2014-02-04 22:08 - 2014-02-04 22:08 - 00000020 _____ () C:\Users\***\defogger_reenable
2014-02-04 22:07 - 2014-02-04 22:07 - 00050477 _____ () C:\Users\***\Downloads\Defogger.exe
2014-02-03 20:10 - 2014-02-03 20:10 - 00000000 ____D () C:\Users\Public\Foxit Software
2014-02-02 21:06 - 2014-02-03 10:05 - 00000000 ____D () C:\Users\***\Desktop\Wohnungen
2014-01-22 18:10 - 2014-01-22 19:03 - 00000000 ____D () C:\Users\***\AppData\Roaming\vlc
2014-01-22 18:07 - 2014-01-22 18:07 - 24097311 _____ () C:\Users\***\Downloads\vlc-2.1.2-win32.exe
2014-01-21 10:32 - 2014-01-21 18:00 - 00000000 ____D () C:\Users\***\AppData\Local\Nero
2014-01-21 10:32 - 2014-01-21 10:33 - 00000000 ____D () C:\Users\***\AppData\Roaming\Nero
2014-01-21 10:24 - 2014-01-21 10:24 - 00000000 ____D () C:\Windows\System32\Tasks\Nero
2014-01-21 09:54 - 2014-01-21 10:06 - 288310920 _____ (Nero AG) C:\Users\***\Downloads\Nero2014-15.0.07100_trial.exe
2014-01-21 09:52 - 2014-01-21 09:52 - 00000000 ____D () C:\Users\***\AppData\Roaming\Ashampoo
2014-01-21 09:52 - 2014-01-21 09:52 - 00000000 ____D () C:\Users\***\AppData\Local\ashampoo
2014-01-21 09:51 - 2014-01-21 09:52 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-01-21 09:45 - 2014-01-21 09:48 - 92789928 _____ (Ashampoo GmbH & Co. KG ) C:\Users\***\Downloads\ashampoo_burning_studio_2014_12.0.5_15376.exe
2014-01-19 11:35 - 2014-01-19 11:18 - 139448593 _____ () C:\Users\***\Desktop\Afrika TV.flv
2014-01-19 10:52 - 2014-01-19 11:02 - 93897148 _____ () C:\Users\***\Desktop\WissensWerte_ Migration - YouTube [720p].mp4
2014-01-18 15:35 - 2014-01-18 15:35 - 00000000 ____D () C:\Users\***\Desktop\Wohnungsgedöns
2014-01-15 20:14 - 2014-02-03 20:10 - 00000000 ____D () C:\Users\***\AppData\Roaming\Foxit Software
2014-01-15 20:12 - 2014-01-15 20:13 - 23867560 _____ (Mozilla) C:\Users\***\Downloads\Firefox_Setup_26.0.exe
2014-01-15 20:11 - 2014-01-15 20:14 - 32747816 _____ (Nero AG) C:\Users\***\Downloads\Nero_BurnLite-10.0.10600.exe
2014-01-15 19:53 - 2014-01-15 19:53 - 03765592 _____ () C:\Users\***\Downloads\Paint.NET.3.5.11.Install.exe
2014-01-15 19:51 - 2014-01-15 19:53 - 33440584 _____ (Foxit Corporation ) C:\Users\***\Downloads\FoxitReader612.1224_enu_Setup.exe
2014-01-15 19:46 - 2014-01-15 19:46 - 01977432 _____ () C:\Users\***\Downloads\winrar-x64-501.exe
2014-01-15 19:45 - 2014-01-15 19:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-15 19:45 - 2014-01-15 19:44 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-15 19:44 - 2014-01-15 19:44 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-15 19:44 - 2014-01-15 19:44 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-15 19:44 - 2014-01-15 19:44 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-15 19:44 - 2014-01-15 19:44 - 00000000 ____D () C:\Program Files\Java
2014-01-15 19:13 - 2014-01-15 19:15 - 50837888 _____ (Adobe Systems Incorporated) C:\Users\***\Downloads\AdbeRdr11006_en_US.exe
2014-01-15 19:13 - 2014-01-15 19:15 - 30796712 _____ (Oracle Corporation) C:\Users\***\Downloads\jre-7u51-windows-x64.exe
2014-01-15 10:00 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 10:00 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 10:00 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 10:00 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 10:00 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 10:00 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 10:00 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 10:00 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 10:00 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-05 19:56 - 2014-01-05 19:56 - 00000000 ____D () C:\Users\***\dwhelper
==================== One Month Modified Files and Folders =======
2014-02-04 22:18 - 2014-02-04 22:18 - 00021880 _____ () C:\Users\***\Downloads\FRST.txt
2014-02-04 22:18 - 2014-02-04 22:17 - 00000000 ____D () C:\FRST
2014-02-04 22:16 - 2014-02-04 22:16 - 00380416 _____ () C:\Users\***\Downloads\gqsfq858.exe
2014-02-04 22:16 - 2014-02-04 22:15 - 02080256 _____ (Farbar) C:\Users\***\Downloads\FRST64.exe
2014-02-04 22:16 - 2010-08-13 11:37 - 01485345 _____ () C:\Windows\WindowsUpdate.log
2014-02-04 22:15 - 2014-02-04 22:15 - 00000000 _____ () C:\Users\***\AppData\Roaming\.NANotifyHere
2014-02-04 22:13 - 2013-02-25 19:21 - 00000000 ____D () C:\Users\***\AppData\Roaming\Dropbox
2014-02-04 22:11 - 2013-04-28 09:34 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-04 22:11 - 2010-08-14 16:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Sunbird
2014-02-04 22:10 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-04 22:10 - 2009-07-14 05:51 - 00143414 _____ () C:\Windows\setupact.log
2014-02-04 22:09 - 2009-07-14 05:45 - 00015344 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-04 22:09 - 2009-07-14 05:45 - 00015344 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-04 22:08 - 2014-02-04 22:08 - 00000584 _____ () C:\Users\***\Downloads\defogger_disable.log
2014-02-04 22:08 - 2014-02-04 22:08 - 00000020 _____ () C:\Users\***\defogger_reenable
2014-02-04 22:08 - 2010-08-13 11:42 - 00000000 ____D () C:\Users\***
2014-02-04 22:07 - 2014-02-04 22:07 - 00050477 _____ () C:\Users\***\Downloads\Defogger.exe
2014-02-04 21:42 - 2013-12-11 16:41 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-04 21:42 - 2013-12-11 16:41 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-04 20:49 - 2013-12-12 19:17 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-04 19:54 - 2010-09-20 16:48 - 00000000 ____D () C:\Program Files (x86)\Zarb 4
2014-02-04 19:42 - 2013-12-11 16:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-04 19:05 - 2013-04-28 09:34 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-03 20:10 - 2014-02-03 20:10 - 00000000 ____D () C:\Users\Public\Foxit Software
2014-02-03 20:10 - 2014-01-15 20:14 - 00000000 ____D () C:\Users\***\AppData\Roaming\Foxit Software
2014-02-03 10:05 - 2014-02-02 21:06 - 00000000 ____D () C:\Users\***\Desktop\Wohnungen
2014-02-03 10:04 - 2010-08-14 14:04 - 00000000 ____D () C:\Users\***\AppData\Roaming\Canon
2014-01-29 16:52 - 2010-08-14 14:04 - 00044085 _____ () C:\Users\***\Sti_Trace.log
2014-01-27 16:49 - 2010-08-13 11:58 - 00100752 _____ () C:\Users\***\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-27 16:48 - 2009-07-14 05:45 - 00388096 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-01-26 11:01 - 2013-06-21 16:04 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-22 19:03 - 2014-01-22 18:10 - 00000000 ____D () C:\Users\***\AppData\Roaming\vlc
2014-01-22 18:07 - 2014-01-22 18:07 - 24097311 _____ () C:\Users\***\Downloads\vlc-2.1.2-win32.exe
2014-01-22 17:12 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-01-21 20:36 - 2013-12-11 16:41 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-01-21 19:11 - 2010-08-13 13:08 - 00000000 ____D () C:\ProgramData\CyberLink
2014-01-21 18:00 - 2014-01-21 10:32 - 00000000 ____D () C:\Users\***\AppData\Local\Nero
2014-01-21 15:47 - 2010-08-13 12:35 - 00647274 _____ () C:\Windows\PFRO.log
2014-01-21 10:33 - 2014-01-21 10:32 - 00000000 ____D () C:\Users\***\AppData\Roaming\Nero
2014-01-21 10:32 - 2010-08-26 12:52 - 00000000 ____D () C:\ProgramData\Nero
2014-01-21 10:24 - 2014-01-21 10:24 - 00000000 ____D () C:\Windows\System32\Tasks\Nero
2014-01-21 10:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Cursors
2014-01-21 10:23 - 2010-08-26 12:52 - 00000000 ____D () C:\Program Files (x86)\Nero
2014-01-21 10:06 - 2014-01-21 09:54 - 288310920 _____ (Nero AG) C:\Users\***\Downloads\Nero2014-15.0.07100_trial.exe
2014-01-21 09:52 - 2014-01-21 09:52 - 00000000 ____D () C:\Users\***\AppData\Roaming\Ashampoo
2014-01-21 09:52 - 2014-01-21 09:52 - 00000000 ____D () C:\Users\***\AppData\Local\ashampoo
2014-01-21 09:52 - 2014-01-21 09:51 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-01-21 09:48 - 2014-01-21 09:45 - 92789928 _____ (Ashampoo GmbH & Co. KG ) C:\Users\***\Downloads\ashampoo_burning_studio_2014_12.0.5_15376.exe
2014-01-19 11:34 - 2009-07-14 18:58 - 00654150 _____ () C:\Windows\system32\perfh007.dat
2014-01-19 11:34 - 2009-07-14 18:58 - 00130022 _____ () C:\Windows\system32\perfc007.dat
2014-01-19 11:34 - 2009-07-14 06:13 - 01498742 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-01-19 11:18 - 2014-01-19 11:35 - 139448593 _____ () C:\Users\***\Desktop\Afrika TV.flv
2014-01-19 11:02 - 2014-01-19 10:52 - 93897148 _____ () C:\Users\***\Desktop\WissensWerte_ Migration - YouTube [720p].mp4
2014-01-18 15:35 - 2014-01-18 15:35 - 00000000 ____D () C:\Users\***\Desktop\Wohnungsgedöns
2014-01-18 10:37 - 2013-02-25 19:21 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-18 10:37 - 2010-08-13 11:42 - 00000000 ___RD () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-15 20:19 - 2013-07-16 21:29 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-15 20:17 - 2010-08-13 12:22 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-15 20:14 - 2014-01-15 20:11 - 32747816 _____ (Nero AG) C:\Users\***\Downloads\Nero_BurnLite-10.0.10600.exe
2014-01-15 20:14 - 2013-12-22 10:46 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-01-15 20:14 - 2012-05-12 13:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-15 20:14 - 2010-08-14 14:16 - 00000000 ____D () C:\Program Files (x86)\Foxit Software
2014-01-15 20:13 - 2014-01-15 20:12 - 23867560 _____ (Mozilla) C:\Users\***\Downloads\Firefox_Setup_26.0.exe
2014-01-15 19:56 - 2010-08-14 14:18 - 00000000 ____D () C:\Program Files (x86)\Paint.net
2014-01-15 19:55 - 2010-08-14 14:17 - 00000000 ____D () C:\Users\***\AppData\Local\Paint.NET
2014-01-15 19:54 - 2013-07-14 22:05 - 00000000 ____D () C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-01-15 19:54 - 2011-07-14 16:27 - 00000000 ____D () C:\Program Files\Winrar
2014-01-15 19:53 - 2014-01-15 19:53 - 03765592 _____ () C:\Users\***\Downloads\Paint.NET.3.5.11.Install.exe
2014-01-15 19:53 - 2014-01-15 19:51 - 33440584 _____ (Foxit Corporation ) C:\Users\***\Downloads\FoxitReader612.1224_enu_Setup.exe
2014-01-15 19:46 - 2014-01-15 19:46 - 01977432 _____ () C:\Users\***\Downloads\winrar-x64-501.exe
2014-01-15 19:45 - 2014-01-15 19:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-01-15 19:44 - 2014-01-15 19:45 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-01-15 19:44 - 2014-01-15 19:44 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-01-15 19:44 - 2014-01-15 19:44 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-01-15 19:44 - 2014-01-15 19:44 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-01-15 19:44 - 2014-01-15 19:44 - 00000000 ____D () C:\Program Files\Java
2014-01-15 19:15 - 2014-01-15 19:13 - 50837888 _____ (Adobe Systems Incorporated) C:\Users\***\Downloads\AdbeRdr11006_en_US.exe
2014-01-15 19:15 - 2014-01-15 19:13 - 30796712 _____ (Oracle Corporation) C:\Users\***\Downloads\jre-7u51-windows-x64.exe
2014-01-05 19:56 - 2014-01-05 19:56 - 00000000 ____D () C:\Users\***\dwhelper
Some content of TEMP:
====================
C:\Users\***\AppData\Local\Temp\AskSLib.dll
C:\Users\***\AppData\Local\Temp\DE_de_Avery_AW31.exe
C:\Users\***\AppData\Local\Temp\DTLite4454-0316.exe
C:\Users\***\AppData\Local\Temp\DTLite4461-0327.exe
C:\Users\***\AppData\Local\Temp\DTLite4471-0333.exe
C:\Users\***\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\***\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\***\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\***\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\***\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\***\AppData\Local\Temp\jre-6u30-windows-i586-iftw-rv.exe
C:\Users\***\AppData\Local\Temp\jre-7u11-windows-i586-iftw.exe
C:\Users\***\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\***\AppData\Local\Temp\nitro_pdf_reader_x64.exe
C:\Users\***\AppData\Local\Temp\nitro_reader3_x64.exe
C:\Users\***\AppData\Local\Temp\ose00000.exe
C:\Users\***\AppData\Local\Temp\TerraTec_Home_Cinema_6.11.05.exe
C:\Users\***\AppData\Local\Temp\TerraTec_Home_Cinema_6.15.11.exe
C:\Users\***\AppData\Local\Temp\uninstall-temp.exe
C:\Users\***\AppData\Local\Temp\vlc-2.0.4-win32.exe
C:\Users\***\AppData\Local\Temp\vlc-2.0.5-win32.exe
C:\Users\***\AppData\Local\Temp\vlc-2.1.2-win64.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-29 08:36
==================== End Of Log ============================
Die restlichen logs gibt's in neuen Beiträgen, da sonst der Text zu lang ist. Tausend Dank im Voraus! |
| Themen zu GenVariant.Jaik.462, Zugriff durch rundll32.exe |
| blockiert, booten, browser, canon, desktop, downloader, fehler, firefox, flash player, genvariant, helper, home, homepage, internet, mozilla, mp3, programm, prozesse, realtek, registry, remote control, rundll, rundll32.exe, scan, security, server, software, svchost.exe, virus |
Baum-Darstellung